Package security

Minimum disclosure

• Never ship server secrets, internal environment files or privileged signing material.
• Keep entitlement, billing, authorization and privileged validation server-side.
• Allowlist packed files and inspect the exact npm payload before release.
• Use immutable versions, integrity metadata, provenance and audit records.